946a0280d82fb211c1721a0cafcd45c1a1b40b646495b8cb9ed1474bb5da9a4f

General

Target

77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe
Size

565KB
MD5

77ddadf7e9f4730c6a6c2f3b28446f8c
SHA1

367c537eaf5ce26e47dc3b6e207457f058f603d9
SHA256

946a0280d82fb211c1721a0cafcd45c1a1b40b646495b8cb9ed1474bb5da9a4f
SHA512

d97c5db7262b8db06162fed2c44b633f36612613bc681d544eba834c09584689203061896182fe4c2b84f1dcac3178571faa311780b00a83c40d9543bc1bc7c2
SSDEEP

12288:yCIswQKL0lZznV2r10xTh7LVoSejNDsBVrCcV/ogRaPNsk1a7mFKsaq:yCIsCYlR8hIT2RcVrCKAtPNsk1a7dhq

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2468-0-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/2468-16-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/3372-18-0x0000000000400000-0x0000000000453F00-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2468-16-0x0000000000400000-0x00000000004B6000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2468 set thread context of 3916	2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	84
PID 3916 set thread context of 3372	3916	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe
2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe
2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe
2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe
2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3916	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3916	2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	84
PID 2468 wrote to memory of 3916	2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	84
PID 2468 wrote to memory of 3916	2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	84
PID 2468 wrote to memory of 3916	2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	84
PID 2468 wrote to memory of 3916	2468	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	84
PID 3916 wrote to memory of 3372	3916	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	85
PID 3916 wrote to memory of 3372	3916	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	85
PID 3916 wrote to memory of 3372	3916	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	85
PID 3916 wrote to memory of 3372	3916	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	85
PID 3916 wrote to memory of 3372	3916	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	85
PID 3916 wrote to memory of 3372	3916	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	85
PID 3916 wrote to memory of 3372	3916	77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Users\Admin\AppData\Local\Temp\77ddadf7e9f4730c6a6c2f3b28446f8c_JaffaCakes118.exe
    3⤵
    PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autCAC2.tmp

Filesize
16KB

MD5
b6076077f354c689d04ea74cc95c4a9e

SHA1
4ef9939d8bf9a46a09ac112dd849228e431f4abd

SHA256
6e455c7681c0e056a670329865f8319e104e63cb034832cf252e3de394756b0f

SHA512
94c292bd5b23f520253ac249b3fe05133286f186df61421e166fc11fdd2602d8ff833337f32a193858daeacfdfe100af588e0e663160637efedece1083d42ecb

Download Submit
memory/2468-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2468-16-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/3372-18-0x0000000000400000-0x0000000000453F00-memory.dmp

Filesize
335KB

Download
memory/3916-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3916-12-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3916-20-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing